See it and Sell it First at ASI Show Orlando – January 4-6, 2025.   Register Now.

December 08, 2023

‘Cybersecurity Risk’ Impacts Staples Promotional Products

It was part of a larger incident that affected the Top 40 distributor’s parent company, Staples Inc.

By  Christopher Ruvo

UPDATE Friday, Dec. 8 10 a.m. ET
A spokesperson for Staples Promotional Products (asi/120601) said Friday morning that the disruption the Top 40 distributor was previously experiencing, as detailed in the article below, has been resolved. “Staples Promotional Products is now fully functional with all communication lines and customer service restored,” according to Chris Tjaden of Staples. Parent company Staples Inc. was reporting that its customer service functions were again operating normally, too.

Top 40 distributor Staples Promotional Products (asi/120601) is working through disruption to its systems amid fallout from a possible cyberattack.

Staples Inc., the office-supply retailer and parent company of Staples Promo, last week said it identified a “cybersecurity risk.” It then took what the firm described in a statement as “proactive steps to mitigate the impact and protect customer data. Our prompt efforts caused temporary disruption to our backend processing and delivery capabilities, as well as our communications channels and customer service lines.”

As for Staples Promo in particular, the distributorship’s e-store fulfillment capabilities were largely uninterrupted and operated as usual, a company spokesperson said. Still, there was some impact to business systems that, as of this writing, continued to be addressed, though the issues were said to be mostly resolved at the firm that’s the North American promotional products industry’s third-largest distributor.

“While some Staples Promotional Products business applications are expected to roll out in priority order, most are back online and operating in the normal course,” Chris Tjaden, senior manager of commercial and brand communications/charitable giving at Staples, told ASI Media.

In a service update to customers, parent firm Staples said that as of early the week of Dec. 3 it was continuing to experience problems with its communications and customer service lines. “All other aspects of our order processing and delivery operations are functioning normally,” the company confimed. “We are working diligently to restore our customer service lines.”

It wasn’t yet clear if any customer or employee data had been compromised.

“Ransomware has rapidly emerged as the most visible cybersecurity risk playing out across our nation’s networks, locking up private sector organizations and government agencies alike.”– Cybersecurity & Infrastructure Security Agency

Staples stopped short of calling the incident a cyberattack, but information security experts have said the situation has the markings of a ransomware attempt. In such cases, a common defense tactic is to swiftly take systems offline to limit the infiltration.

Ransomware assaults center on the use of malicious software to block a company’s access to its files and systems until a sum is paid. Recently, MGM Resorts lost a reported $100 million in a ransomware targeting. The loss was predominantly a result of disruption that occurred when it took systems, including slot machines, offline, according to media reports.

Security experts said the holidays can prove a particularly attractive time for hackers to advance ransomware attacks on businesses, which may be quicker to pay rather than suffer an extended outage that would result in significant amounts of lost business during the busy year-end buying period. Successful phishing attempts are the most common launch points for ransomware incursions.

“Wily attackers know that December is the perfect time to strike to cause maximum disruption with minimal resistance, and businesses cannot afford to ignore the risk,” Rick Jones, CEO of cybersecurity firm DigitalXRAID, told InfoSecurity Magazine. “Cybercriminals are likely to continue to exploit the holidays as an opportunity to strike when IT support teams are operating at reduced capacity.”

Promo firms large and small have been victimized by ransomware and other cyberattacks in recent years. These include a 2019 hacking at Top 40 firm alphabroder (asi/34063), which paid a ransom. Top 40 supplier Hit Promotional Products (asi/61125) contended with what was described as a cybersecurity incident in March of this year.

Meanwhile, MV Sport/The Game (asi/68318) sustained an attack in September/October 2022. Aakron Line (asi/30270) dealt with a malware issue. HanesBrands (asi/59528) was compromised last year. Essent Corporation, a promo-focused business management platform, fell prey to an encryption attack in late 2022.

Ransomware reportedly accounted for around 20% of all cyber-crimes in 2022. An estimated 623.3 million ransomware attacks occurred globally in 2021 – though the real number may have been higher. Cybersecurity testing can help protect against attacks.

“Ransomware has rapidly emerged as the most visible cybersecurity risk playing out across our nation’s networks, locking up private sector organizations and government agencies alike,” said the U.S. government’s Cybersecurity & Infrastructure Security Agency. “And that’s only what we’re seeing – many more infections are going unreported, ransoms are being paid and the vicious ransomware cycle continues on.”

Protect Your Business

The National Institute of Standards & Technology offers the following advice to help businesses protect themselves from a ransomware attack.

  • Use antivirus software at all times – and make sure it’s set up to automatically scan your emails and removable media (e.g., flash drives) for ransomware and other malware.
  • Keep all computers fully patched.
  • Use security products or services that block access to known ransomware sites on the internet.
  • Configure operating systems or use third-party software to allow only authorized applications to run on computers, thus preventing ransomware from working.
  • Restrict or prohibit use of personally owned devices on the organization’s networks and for telework/remote access without taking extra steps to assure security.
  • Employees should use standard user accounts instead of accounts with administrative privileges whenever possible.
  • Employees should avoid using personal applications and websites, such as email, chat and social media, from work computers.
  • Workers should avoid opening files, clicking on links, etc. from unknown sources without first checking for suspicious content. For example, an individual can run an antivirus scan on a file or look at a link to see if it really goes to the site it claims to be going to.